Volunteer Software Review Procedure

Business Partners and Third Party Vendors may volunteer their software applications for the purposes of integrating with the Firewall and HIPS product lines, developing new partnerships, or inclusion within the CA Direct Sales Channel.

According to policy, all software volunteered must first be reviewed against the CA Anti-Spyware Scorecard. The scorecard represents CA's published criteria by which software is evaluated for potentially unwanted behaviors. Any volunteered software that exhibits behaviors as defined within the scorecard will be not be authorized for integration until those behaviors can be addressed.

Should the application fail to pass the scorecard, CA reserves the right:

• not to whitelist the application
• to label the application as "potentially unwanted" and create signatures for CA Anti-Spyware and HIPS products
• to mark the application as "malware" and create signatures for CA Anti-Virus products

If the nominated application fails the published CA Anti-Spyware scorecard following a completed Volunteer Software Review process, the vendor will receive a documented scorecard and the company has the right to appeal via the process defined within the Vendor Appeals procedure.

Volunteer Software Review Process

1. Third Party submits candidate application for either integration with the Firewall and HIPS product lines or the Sales Channel. This is accomplished by filling out the appropriate Volunteer Software Submission form:
   1. Firewall Integration Request
   2. Sales Channel Integration Request


2. A confirmation email will be returned when the Review Request email is received.



3. The requested review will be processed within 2 business weeks.



4. The candidate application is evaluated against the currently published Anti-Spyware Scorecard.



5. The scorecard results will be communicated back to the Vendor. If the software passes the scorecard, the Vendor will be informed and the nominated software will be either included in the firewall whitelist or entered into the Direct Channel Sales program depending upon the original intent of the software review request. If the software fails the scorecard the Vendor will be informed and a provided a30-day respite address the reasons for failing before CA will consider the software for addition to the Anti-Spyware or Anti-Virus detections.
   
   If the program in question is deemed malicious in nature, CA reserves the right to create signatures for detection immediately. Subsequent communications regarding a program deemed malicious must follow the vendor appeals procedure.



6. The vendor then has the option to appeal the original Scorecard by responding within 30 days of receiving the original scorecard results.



7. The appeal must denote the changes that will address the failing behaviors noted in the Scorecard results.



8. If a response is received within the 30 day respite time period a new review cycle will begin returning the process to step 2.



9. If two complete review cycles (60 days) transpire without fundamental change introduced to enable passing of the scorecard, the nominated program will be added into the appropriate detection database without further appeal. If this point is reached the nominated program will not be eligible for review for 180 days at which point a new Volunteer Software Review Request will have to be opened.



10. If no changes are received within a given 30 day respite the nominated program will be added to the appropriate detection database.



11. Following inclusion in the Threat Detection Database any subsequent appeal must be handled by the Vendor Appeals process.

Please Note: At the current time, our sample submission system correspondence is in English only. If you require additional assistance in a language other than English, please contact your local support office during normal business hours using the contact details supplied here: http://www.ca.com/us/contact/default.aspx.